CVE-2025-38053

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix null-ptr-deref in idpf_features_check

idpf_features_check is used to validate the TX packet. skb header

length is compared with the hardware supported value received from

the device control plane. The value is stored in the adapter structure

and to access it, vport pointer is used. During reset all the vports

are released and the vport pointer that the netdev private structure

points to is NULL.

To avoid null-ptr-deref, store the max header length value in netdev

private structure. This also helps to cache the value and avoid

accessing adapter pointer in hot path.

BUG: kernel NULL pointer dereference, address: 0000000000000068

...

RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf]

Call Trace:

<TASK>

? __die+0x23/0x70

? page_fault_oops+0x154/0x520

? exc_page_fault+0x76/0x190

? asm_exc_page_fault+0x26/0x30

? idpf_features_check+0x6d/0xe0 [idpf]

netif_skb_features+0x88/0x310

validate_xmit_skb+0x2a/0x2b0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References